fix: enforce bundled agent and Loop ownership - #326

#!/bin/bash
set -euo pipefail

rg -n -C 6 'toolApprovalCallID|RequestToolApproval|ToolCallID|CorrelationID' --glob '*.go' . || true
rg -n -C 8 '\bCallRequest\s*\{|\bToolCallID\s*:' --glob '*.go' . || true

#!/bin/bash
set -euo pipefail

printf '--- locating tool_approval_bridge.go ---\n'
fd -a 'tool_approval_bridge\.go$' . || true

printf '\n--- relevant file outline ---\n'
ast-grep outline internal/daemon/tool_approval_bridge.go || true

printf '\n--- relevant file lines ---\n'
sed -n '1,260p' internal/daemon/tool_approval_bridge.go

printf '\n--- focused definitions and approvals ---\n'
rg -n -C 4 'func .*RequestToolApproval|func .*ApplyToolApproval|func .*toolApprovalCallID|type CallRequest|ToolCallID|CorrelationID|ToolCall update|Approval.*Pending|pending request|decisions|decision' internal/daemon internal/tools internal -g '*.go' | sed -n '1,240p'

#!/bin/bash
set -euo pipefail

echo '--- locating tool_approval_bridge.go ---'
fd -a 'tool_approval_bridge\.go$' . || true

echo
echo '--- relevant file outline ---'
ast-grep outline internal/daemon/tool_approval_bridge.go || true

echo
echo '--- relevant file lines ---'
sed -n '1,260p' internal/daemon/tool_approval_bridge.go

echo
echo '--- focused definitions and approvals ---'
rg -n -C 4 'func .*RequestToolApproval|func .*ApplyToolApproval|func .*toolApprovalCallID|type CallRequest|ToolCallID|CorrelationID|ToolCall update|Approval.*Pending|pending request|decisions|decision' internal/daemon internal/tools internal -g '*.go' | sed -n '1,260p'

#!/bin/bash
set -euo pipefail

echo '--- CallRequest definition/usages ---'
rg -n -C 5 'type CallRequest|ToolCallID\s+|CorrelationID\s+|ApprovalToken' internal -g '*.go' | sed -n '1,320p'

echo
echo '--- approval bridge tests mentioning rejection/fallback ---'
fd -a 'native_tool_approval*|tool_approval_bridge*' internal | sed -n '1,120p'
if [ -f internal/daemon/native_tool_approval_test.go ]; then
  sed -n '1,280p' internal/daemon/native_tool_approval_test.go
else
  echo 'internal/daemon/native_tool_approval_test.go not found'
fi

echo
echo '--- approval contracts definitions ---'
rg -n -C 8 'type ApprovalBridge|Method RequestToolApproval|ApplyToolApproval|ToolCallID|CorrelationID' internal/tools internal -g '*.go' | sed -n '1,260p'

#!/bin/bash
set -euo pipefail

echo '--- tool_approval_bridge_test.go ---'
sed -n '1,420p' internal/daemon/tool_approval_bridge_test.go

echo
echo '--- approval bridge implementation and bridge invocation ---'
sed -n '260,460p' internal/tools/tool.go
sed -n '130,240p' internal/tools/dispatch.go
rg -n -C 5 'RequestToolApproval|approve-all|ApprovalAvailable|permission|ApprovalRequired|ApprovalUnreachable|ApprovalTimedOut|ApprovalCanceled' internal/daemon -g '*.go' | sed -n '1,320p'

#!/bin/bash
set -euo pipefail

echo '--- approval bridge tests continuation ---'
sed -n '420,660p' internal/daemon/tool_approval_bridge_test.go

echo
echo '--- CallRequest identity fields in non-test production tools internal ---'
python3 - <<'PY'
from pathlib import Path
import re
needle = re.compile(r'CallRequest\{')
for p in sorted(Path('internal').rglob('*.go')):
    if '/testdata/' in str(p) or p.suffix != '.go':
        continue
    text = p.read_text()
    if text.startswith('package ') and (text.startswith('package test') or text.startswith('package mocks')):
        continue
    ms = [m for m in needle.finditer(text) if not text[m.start()-200:m.start()].strip().startswith('//') and not text[m.start()-200:m.start()].strip().startswith('/*')]
    if not ms:
        continue
    print(f'FILE {p}')
    for m in ms:
        line = text.count('\n', 0, m.start()) + 1
        print(f'  line {line}')
        block = text[m.start():]
        brace = 0
        for i, ch in enumerate(block):
            if ch == '{':
                brace += 1
            elif ch == '}':
                brace -= 1
                if brace == 0:
                    body = block[:i+1]
                    break
        else:
            body = block
        for field in ['ToolCallID', 'CorrelationID', 'SessionID', 'ApprovalToken', 'ToolID']:
            hits = [(x.strip()+':', f'{field}:') for x in body.split('\n') if (field+':') in x or field + ',' in x]
            print(f'    {field}:', ' '.join(hits[:5]))

echo
echo '--- production calls to approval bridge ---'
rg -n -C 8 'bridge\.RequestToolApproval|RequestToolApproval\(' internal -g '*.go' --glob '!*_test.go' | sed -n '1,260p'

#!/bin/bash
set -euo pipefail
export LC_ALL=C

echo '--- approved-tool-call callers (non-test) ---'
rg -n -C 8 'ApprovedToolCall|approved-tool-call|approve-tool-call|ApproveToolCall|ApprovalRequired' internal -g '*.go' --glob '!*_test.go' | sed -n '1,260p'

echo
echo '--- production Read/Approval bridge wiring references'
rg -n -C 5 'approvalbridge|ApprovalBridge|ApprovedToolCall|toolApprovals|ApproveToolCall|ToolApprovalsSet|ApprovalRequired|approvalprobe' internal -g '*.go' --glob '!*_test.go' | sed -n '1,320p'

echo
echo '--- tool_approval_bridge_grants.go relevant sections'
sed -n '1,320p' internal/daemon/tool_approval_bridge_grants.go

#!/bin/bash
set -euo pipefail

ast-grep outline internal/store/sessiondb/read_only_pool.go --items all
rg -n -C 5 'func \(p \*ReadOnlyPool\) (finishOpening|Close)|func openSessionDBReadOnlyWithRetry|context\.WithoutCancel|context\.WithDeadline|context\.WithTimeout|Deadline\(' internal/store/sessiondb

#!/bin/bash
set -euo pipefail

echo "== read_only_pool.go relevant sections =="
sed -n '1,130p' internal/store/sessiondb/read_only_pool.go
sed -n '156,260p' internal/store/sessiondb/read_only_pool.go
sed -n '258,330p' internal/store/sessiondb/read_only_pool.go

echo "== read_only_pool shutdown =="
sed -n '1,220p' internal/store/sessiondb/read_only_pool_shutdown.go

echo "== read_only.go open helper/retry =="
sed -n '1,240p' internal/store/sessiondb/read_only.go

echo "== all WithTimeout/WithDeadline/Deadline/context.WithoutCancel in files under internal/store/sessiondb =="
rg -n -C 4 'context\.WithoutCancel|context\.WithTimeout|context\.WithDeadline|Deadline\(|deadline|timeout|deadline=|ttl=' internal/store/sessiondb --glob '*.go'

#!/bin/bash
set -euo pipefail

echo "== OpenSessionDBReadOnly callers that set ReadOnlyPool Open option =="
rg -n -C 8 'OpenSessionDBReadOnly(\(|\s*|,|ReadOnlyPoolConfig|WithReadOnlyOpenRetry|--Open' internal --glob '*.go' | sed -n '1,240p'

echo "== NewReadOnlyPool Open config assignments =="
rg -n -C 6 'NewReadOnlyPool\(|ReadOnlyPoolConfig|Open:' internal --glob '*.go' | sed -n '1,260p'

echo "== read_only.go context usage and retry delay =="
sed -n '220,290p' internal/store/sessiondb/read_only.go

echo "== SQL context propagation around read-only opener path =="
rg -n -C 3 'MustContext|ExecContext|QueryRowContext|QueryContext|PrepareContext|Context\(\)$' internal/store/sessiondb/sqlcgen internal/store/sessiondb -g '*.go' | sed -n '1,220p'

#!/bin/bash
set -euo pipefail

echo "== OpenSessionDBReadOnly callers from internal/ =="
rg -n -C 8 'OpenSessionDBReadOnly|WithReadOnlyOpenRetry|NewReadOnlyPool\(|ReadOnlyPoolConfig|Open:' internal --glob '*.go' | sed -n '1,340p'

echo "== read_only.go retry delay implementation =="
sed -n '220,290p' internal/store/sessiondb/read_only.go

echo "== read_only_pool.go constructor and config default path =="
sed -n '127,155p' internal/store/sessiondb/read_only_pool.go